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Abstract 

Our previous work presented an approach for 
developing high confidence algorithms for recovering 
aircraft from loss of separation situations. The 
correctness theorems for the algorithms relied on 
several key assumptions, namely that state data for all 
local aircraft is perfectly known, that resolution 
maneuvers can be achieved instantaneously, and that 
all aircraft compute resolutions using exactly the 
same data. Experiments showed that these 
assumptions were adequate in cases where the 
aircraft are far away from losing separation, but are 
insufficient when the aircraft have already lost 
separation. This paper describes the results of this 
experimentation and proposes a new criteria 
specification for loss of separation recovery that 
preserves the formal safety properties of the previous 
criteria while overcoming some key limitations. 
Candidate algorithms that satisfy the new criteria are 
presented. 

Introduction 

Distributed self-separation is an air traffic 
management concept where individual aircraft make 
independent decisions about how to the resolve 
conflicts they encounter [1]. Due to concerns about 
pilot workload, efficiency, and situational awareness, 
these decisions are often accomplished through 
sophisticated automation. In our previous work [2, 3], 
algorithms that recover from loss of separation were 
developed along with a verification approach to 
obtain high confidence in the safety of these 
algorithms. Furthermore, we presented an approach 
that enables the aircraft to use different loss of 
separation recovery algorithms while still 
guaranteeing a safe recovery, even when aircraft 
simultaneously maneuver in response to a loss of 
separation situation. This safety property is called 
implicit coordination. The approach is based on the 
concept of criteria that each algorithm must satisfy. 
A formal proof was developed that shows that 
meeting the criteria is sufficient to guarantee implicit 


coordination. The important consequence is that any 
algorithm that satisfies the criteria will safely operate 
with any other algorithm that also satisfies the 
criteria. 

The original criteria specification for loss of 
separation (LoS) recovery was based on the concept 
of divergence. Two aircraft are in divergent 
trajectories if the distance between the aircraft 
monotonically increases. Loss of separation 
algorithms that satisfy the divergence criteria are 
guaranteed to yield divergent trajectories, when one 
or both aircraft maneuver according to the 
algorithms. Through experimentation, it was 
discovered that the correctness property of 
divergence did not match real-world expectations and 
that the loss of separation algorithms based on the 
concept of divergence depended on some overly 
optimistic assumptions. In this paper, we present the 
results of the deficiencies discovered in the earlier 
approach and a revised criteria that solves most of the 
problems encountered. 

We have developed a state-based, multi-aircraft 
conflict detection and resolution computer program 
called Chorus based upon our criteria. This program 
seeks to compute resolution maneuvers that avoid 
conflicts with all aircraft within a specified lookahead 
time. The program gives special attention to the most 
urgent conflict, that is, the conflict that has the 
smallest time to loss of separation or, in the case of 
LoS, the aircraft that is nearest at the time of closest 
approach. An implicitly coordinated resolution 
maneuver with respect to the most urgent aircraft is 
returned. The program also seeks to make this 
resolution free of secondary conflicts, that is, the 
resolution maneuver is free of traffic conflicts within 
the specified lookahead time. 

Notation 

The criteria approach assumes that both the 
position and velocity vectors of the aircraft are 
known. Vector variables are written in boldface, e.g., 
v, and their components are referenced by sub- 



indices, e.g., v , v , and v . Position and velocity 

x y z 

vectors for the ownship are denoted s q and v q , 
respectively. Traffic vectors are denoted s. and v., 

and resolution velocity vectors are denoted by primed 
variables, e.g., v' o and v\. We often use a relative 

coordinate system where the traffic aircraft is located 
at the origin of the system and is motionless. The 
relative position and velocity vectors of the ownship, 
with respect to the intruder, are denoted s and v, 
respectively, where s=s o -s. and v=v -v.. 

The Criteria Approach 

A loss of separation occurs when two aircraft are 
both horizontally and vertically closer than pre- 
specified limits. Aircraft in a loss of separation must 
maneuver to recover separation. Our approach to 
guaranteeing recovery of such maneuvers is based 
upon the concept of a criteria specification layer 
shown Figure 1 . 
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Algorithm M 

Figure 1. Criteria-based algorithm verification 

The correctness properties associated with the 
horizontal and vertical maneuvers insure both 
independent and coordinated correctness. In other 
words, safe operation is guaranteed if only one 
aircraft maneuvers or if both aircraft maneuver. The 
intermediate specification layer is called criteria. We 
have separate concepts for horizontal and vertical 
correctness, and therefore separate criteria for the 


horizontal and vertical dimensions as well. There is a 
formal proof that the horizontal criteria satisfy the 
horizontal correctness property and a formal proof 
that the vertical criteria satisfies the vertical 
correctness property. Many different algorithms can 
then be shown to satisfy the criteria and thereby 
inherit the associated correctness properties. One 
interesting consequence is that all possible 
combinations of the algorithms that meet the criteria 
will have coordinated solutions: each aircraft can 
execute its own, possibly proprietary, algorithm as 
long as it satisfies the criteria. 

The original concept of correctness for loss of 
separation recovery was centered on the idea of 
divergence and timeliness. The correctness theorems 
depend upon the following assumptions: (1) that 
aircraft state data is perfectly known, (2) the solution 
vectors can be achieved instantaneously, and (3) all 
aircraft compute their solutions using exactly the 
same data. In many real-world situations these 
assumptions are invalid. A key validation task is to 
assess the operational consequence when these 
assumptions are violated. We have found that in a 
conflict situation , i.e., when aircraft are predicted to 
lose separation within a given lookahead time, 
violations of these assumptions do not change the 
resolution: as there is often time to correct initial 
errors. However, in a loss of separation situation 
these assumptions are too strong. This paper 
explores how we account for discrepancies. 

The original criteria for both horizontal and 
vertical recovery required divergence, where 
horizontal divergence is defined as follows: 

xy_divergent? (s, v)=Vf : t>0\ Is I Id Is-Hvl I . 

This property means that for all time in the future, the 
relative horizontal distance between the aircraft is 
greater than it was initially. In a similar manner, the 
vertical divergence is defined as follows: 

z_divergent? (s,v)=V^:f>OI^I<l^+v^l. 

Evidence Of Insufficiency 

In the fall of 2011, we began to experimentally 
validate our loss of separation algorithms 
implemented in the Chorus program using simple 
kinematic models for the aircraft trajectories. 
Although there were many situations where our 














algorithms performed well, there were other 
situations where they performed poorly. These 
situations primarily fell into two categories: 
inappropriateness of some of our assumptions and of 
the divergence property for generating achievable 
resolutions, and discontinuities observed in suggested 
resolutions as they evolved over time. More 
specifically, the following deficiencies were 
discovered: 

1. Maneuvers could be overly restricted by the 
divergence property, occasionally resulting in 
unreasonably severe or even non-existent 
resolutions. For example, there are cases where a 
much smaller turn is sufficient to recover from 
loss of separation. 

2. How one achieves a maneuver is more important 
to overall safety than the maneuver goal. The 
divergence criteria did not specify a turn 
direction and in some cases, the minimal turn 
direction is not the best. 

3. Occasionally divergence would occur without 
maneuvering within a few seconds and yet our 
approach produced poor results because it only 
sought solutions that immediately achieved 
divergence. 

4. The switch from conflict avoidance to loss of 
separation recovery would sometimes result in 
radical changes in the calculated resolutions. 

5. In some cases, the resolutions would switch 
direction back and forth as time progressed. This 
lack of continuity led us to add requirements 
about sequences of resolutions over time that we 
had originally not foreseen. 

The rest of this section shows scenarios that illustrate 
the deficiencies enumerated above. 

Overly Restricted Maneuvers 

As we explored the criteria concept with 
hundreds of test cases, we began to notice that there 
were cases where the maneuvers were extreme using 
our original criteria for recovery from loss of 
separation. 

Figure 2 illustrate this situation. The green area 
indicates the allowed region of track resolutions, and 
the red area indicates the disallowed region. The 
longer black and magenta vectors show the current 
velocity vectors of the ownship and intruder, 
respectively. For both aircraft the allowed maneuvers 
are quite severe. 


If the original track of the traffic aircraft is 
changed to 210 degrees, then the consequence is 
shown in Figure 3 where the blue region indicates 
acceptable vectors. The situation has changed 
significantly. As indicated by the figure, one aircraft 
no longer has any track solutions available. 
Admittedly, this is a fairly extreme example in that 
the loss of separation is significant - the aircraft are 
only 1.97 nm apart. However, it does illustrate the 
fact that divergence is probably too strong of a notion 
of correctness. 


Figure 2. Criteria for LoS: Extreme Maneuver 


Figure 3. Horizontal Divergence Criteria 

We have also discovered situations where no 
horizontal maneuvers were obtained even where the 
current separation is over four nautical miles. This 
can occur when there is a large difference between 




the ground speeds of the aircraft. In this case, the 
slower aircraft may have no maneuvers available. 
This scenario is illustrated in Figure 4. 



Figure 4. No Horizontal Resolutions 


Impact of Ignoring Maneuver Direction 

The original criteria only presented a set of 
resolutions, not the direction to achieve a resolution. 
If the maneuver could be achieved instantaneously, 
as our original proofs assumed, then the direction of 
the maneuver would be irrelevant. 



Figure 5. Impact of Turn Maneuver 


The dotted line in Figure 5 shows the path of the 
ownship for both left and right turns. The aircraft can 
turn either left or right to reach the allowed green 
region. In this scenario, it is clear that the left 
maneuver requires a much greater time to achieve the 
goal track. In fact, recovery from the loss of 
separation will be achieved long before the goal track 


is reached. It is also not clear which turn direction is 
best. In fact, if the traffic aircraft does not maneuver, 
then the distance at the closest point of approach is 
shorter if the aircraft turns right, i.e., left turn: 0.44 
nm vs. right turn: 0.19 nm. If neither aircraft 
maneuvers, the aircraft will be 0.18 nm at the closest 
point, which is only slightly worse than the right turn 
case. This is unfortunate because it is usually 
preferable to choose the smaller maneuver. 1 But, 
what if the traffic aircraft also maneuvers? It is not 
the final track that matters, but rather the direction of 
the turn that determines how close the aircraft 
become. This suggests that the notion of correctness 
for loss of separation should be concerned primarily 
about the direction of the turns and not the goal 
tracks. Figure 6 shows an example where the path to 
the final divergent solution tracks brings the aircraft 
within 0.01 nm of each other. 




Figure 6. Close Encounter 


The gold dot on the trajectories shows the future 
point of closest approach. The turns were calculated 
using the following simple kinematic model that 
defines a turn with radius R : 


g tan cp’ 

where v is the ground speed of the aircraft, g is the 
gravitational acceleration, and cp is the bank angle of 
the aircraft. 


1 This is what our ACCoRD CRSS program does. 


A similar problem occurs for vertical 
maneuvers. The vertical path of the aircraft under a 
constant acceleration is shown in Figure 7. In this 
figure the aircraft is accelerating from a negative 
vertical speed to a positive vertical speed. In this 
case, the impact is minimal because the aircraft have 
a large horizontal separation. 



Figure 7. Vertical Path Of The Aircraft Under 
Constant Acceleration 


The case where the horizontal separation is 
small and an aircraft is descending on top of another 
aircraft is especially critical. This case is illustrated in 
Figure 8. In this case it is unclear whether the safe 
maneuver is to go up or to go down. Answering this 
question relies on a fairly accurate model of the 
performance of both aircraft. The necessity of aircraft 
performance knowledge is illustrated in Figure 9 by 
using the same scenario, but with the acceleration cut 
in half. 



Figure 9. Impact of Vi Acceleration On Vertical 
Maneuvers 

Unnecessary Maneuvers 

In Figure 10a we see a situation where a fairly 
dramatic vertical maneuver is required. In this figure, 
the rectangle is the protection zone that contains both 
the ownship (black) and the traffic aircraft (magenta). 
The criteria region is displayed in pink. 

(a) 0 sec 



(b) +10 sec 


Figure 10. Momentum Switch 

The solution space contains only positive 
vertical speeds even though the current vertical speed 
is negative. Ironically, the situation will change 
dramatically in less than 10 seconds, as shown in 
Figure 10b. Here the criteria demand a negative 
vertical speed. The basic issue is that the criteria will 
produce vastly different guidance due to the 
momentum of the aircraft. In this situation, the 
negative solution is clearly better, but our published 
divergent criteria chooses the positive vertical speed 
solutions. 


Figure 8. Impact of Acceleration On Vertical 
Maneuvers 



Rapid Resolution Change During Transition 
from Conflict to LoS 

As an aircraft closes in on a protection zone of 
another aircraft, the maneuvers needed to avoid a loss 
of separation become increasingly severe. This 
situation is illustrated in Figure 11. 


(a) 0 sec, 229° , turn left to 183 


k 


Conflict 

Resolutions 


Figure 11. Resolution with Instantaneous Turn 
Model 

Once the aircraft enters the protection zone, a 
less severe maneuver is immediately obtained 
because the objective becomes to recover from loss 
of separation. The pilot is confronted with a large 
change in the resolution maneuver. Even when the 
resolutions are in the same direction, this sudden 
relaxation in maneuver severity can be confusing to a 
pilot. 

Continuity of Solutions Over Time and The 
Impact of Critical Points 

If the track angle of one aircraft is changed, the 
conflict resolutions will also change. In fact in certain 
critical situations, the resolution can switch from a 
turn right to a turn left maneuver. This is illustrated 
in Figure 12 where an aircraft has slight fluctuations 
in its track angle (possibly due to sensor noise) over a 
3 second time period. In each case, the black arrow 
represents the actual velocity of the aircraft. In 

Figure 12a the current ownship track is 229° and the 
resolution is a turn left resolution that causes the 
aircraft to cross in front of the other aircraft. In 
Figure 12b, one second later, the current track of the 

ownship is 230° and the resolution is a right turn that 
causes the aircraft to cross behind the other aircraft. 

One second later, back at 229 ° , the suggested 
resolution again is to turn left , as seen in Figure 12c. 

There clearly must be a track angle where the 
switch occurs; in this case it occurs at track 230. We 
call this track a critical point. Critical points occur in 
both the horizontal and vertical dimensions and in 
both conflict and loss of separation situations. If an 
aircraft’s current direction is precisely at a critical 
point, then a minor change in the track can cause a 
switch from a turn right resolution to a turn left 
resolution, or vice versa. 




(c) +2 sec, 229° , turn left to 183° 



Figure 12. Resolutions Near a Critical Point 


If the aircraft stays close to this track but 
wanders from one side to another, then one can have 
a rapid oscillation of the turn direction over time. 
This behavior can be very confusing to a pilot. 

A New Approach 

Upon examining the trajectories of the aircraft 
while maneuvering according to the simple kinematic 
models, it became clear that, in the loss of separation 
case, the direction of the maneuver is more important 
than the exact maneuver. In the loss of separation 
case, the pilot will execute the maximum safe bank 
angle to achieve the fastest turn possible, the fastest 
climb, or the fastest descent available. The important 
thing is that, if both pilots maneuver, then their 
actions should be coordinated, i.e., the combination 
of the resolution maneuvers should avoid collision. 

For this reason, the previously presented 
definitions of correctness and the loss of separation 
criteria are too constraining. In our previous work [2, 
3], the notion of correctness consisted of two 
components (1) the maneuver resulted in divergence, 
and (2) the maneuver resulted in a timely exit from 
loss of separation. The new criteria presented here are 
based on the concept of repulsion. 

Repulsive Criteria For LoS Recovery 

The concept of repulsion, presented below, is 
based on the idea that to recover from loss of 
separation, maneuvers should continually improve 
the situation while the maneuver is being executed 
rather than just the final state being an improvement 
over the current situation. This is due to the relative 
proximity of aircraft that are in a loss of separation, 
which makes the intermediate states, between the 
current time and the time when a resolution is 
achieved, more important. The mathematical concept 
of repulsion is presented in [4]. 

The new horizontal criterion for loss of 
separation recovery 

horizontal_los_criterion? (s,v,s^)(v’) 
is defined as follows. 

• Ifs- v<0, thens^s- v x <0, s^v'- v x <0, and 
(s- v ? >0 or 

horizontal_entry? (s,v')). 

• If s- v>0, then s- v>s- v. 


The new vertical criterion for implicitly coordinated 
loss of separation recovery 

vertical_los_criterion? (s,v,e v )(v') 

is satisfied when all the following conditions hold. 

• Qs\<H). 

• s v' >s v A-e v (v'- v)+s v f (v- v)>0, when 

vzvz 

8 v >0. Otherwise, 8 v' >0. 

V z v z 

• s v >minRelVert Speed, when 8 v <0. 

V z V z 

Otherwise, 

e v v z > max(minRelVertSpeed,|t; z |). 

In this formula, minRelVertSpeed is a constant 
parameter representing an arbitrary positive 
minimum relative vertical speed. Furthermore, the 
dot products are two-dimensional dot products. 

Choice of Direction Parameters, 8^ and 8 y 

The criteria presented in the previous section use 
two direction coordination parameters 8^ and s v , 

which take on values ±1. In our figures, green 
vectors indicate an 8^ of +1 and blue vectors indicate 

an 8^ of -1. These parameters capture the notions of 

turning direction in the horizontal dimension and up- 
or-down in the vertical dimension. 2 From the 
standpoint of the criteria, in most cases, the choice is 
arbitrary, and either choice is safe. Therefore, we can 
choose the epsilon values based on other factors, such 
as minimizing the size of the turn. 

Although there are many schemes that could be 
developed for the horizontal parameter 8^ , this 

parameter must satisfy the following property: 

e A (s,v)=e A (-s,-v). 

We propose the following formula: 

e^=sign(s- v 1 ). 


2 Note that these parameters determine direction in a relative 
frame. The actual maneuver when e^=+l, for example, could be 

either a left or a right turn from the pilot’s point of view, 
depending on the situation. 



The parameter value s y for the vertical criterion must 
satisfy the following property: 
s v (s,v)=-s v (— s-v) 

The vertical loss direction parameter is defined 
using a smaller inner collision zone. We propose the 
following formula: 

s^(s,v)= break_vz_symm (vert_dec_vect(s,v)), 

where vertical_dec_vect(s,v) is defined by cases: 

• If (s^O and cd3d_ever? (caD,caH,s,v)) or v=0, 
then s; 

• else if (v =0 and v =0) or s=0, then v; 

v x y 7 

• else if s- v<0, then s+xv; else s. 

In this formula, the dot product is two-dimensional 
— s* v 

and t= — . The predicate cd3d_ever? is a three - 
v z 

dimensional conflict probe that tests if the aircraft are 
in conflict with an inner collision zone of diameter 
caD and height caH. The multiple branches cover 
different cases. The third branch is the key branch 
that covers most cases. It is continuous over time if 
the aircraft velocity vectors are constant. 

The New Repulsive Algorithms 

The new repulsive algorithms use iteration to 
find solutions. They search in the direction that is 
repulsive and stop the search when a divergent 
velocity vector or a non-repulsive vector is reached. 

The repulsive track algorithm chooses a starting 
track and a search direction based on the current 
criteria, and then iteratively checks successively 
larger resolution turns in that direction. It continues 
until it reaches a maneuver that is either divergent or 
no longer repulsive, and then stops, returning that 
maneuver. For the kinematic version, the algorithm 
advances time as part of this iterative search, at each 
step linearly projecting the traffic and recalculating 
the position and velocity of the ownship along the 
turn before determining the maneuver’s divergence 

or repulsiveness. The search terminates once a 180° 
turn is reached, if it has not found an earlier solution. 

After a solution is found for the most urgent 
conflict, the search will continue over the remaining 
unexplored repulsive tracks until all secondary 


conflicts are avoided as well. If this is not possible 
then the solution for the most urgent aircraft is 
returned. A flag is set if the kinematic search enters a 
LoS with another aircraft before it is able to find a 
resolution for the primary. 

The ground speed and vertical speed algorithms 
are nearly identical, with user-defined velocity limits 
for the ownship. A forthcoming NASA report will 
fully document these algorithms. 

Achieving Continuity 

Under the stress of a near term loss of 
separation, pilots may become confused if the 
resolutions change too fast. Therefore, it is important 
that CD&R algorithms do not switch from turn right 
to turn left (and vice versa) or from go up to go down 
(or vice versa) solutions too quickly as time 
progresses. We call this property continuity. 

Continuity Into LoS 

At some point during the entry into LoS, the 
track maneuver becomes infeasible, i.e. the aircraft is 
not able to complete the proposed maneuver without 
entering LoS. At this point it is probably more 
prudent to produce a resolution that is consistent with 
the resolution that will be issued once LoS has 
occurred. The goal is no longer to avoid loss of 
separation, but rather to minimize the depth of the 
entry. 

In these cases we instead project the state 
vectors linearly to a time exactly 1/2 second after 
entry into LoS. We then use the LoS resolution 
algorithms on this time-projected data. 

Continuity Near A Critical Point 

When an aircraft’s current state is located near a 
critical point, rapidly changing resolutions are 
possible as time progresses. This is due to slight 
variations in the track due to external disturbances 
and the inability of any system to perfectly follow a 
track. There are several possible approaches to 
dealing with this problem: 

• Use dead bands. In this case, the algorithm 
freezes the resolutions while the aircraft stays on a 
critical point. 

• Filter the direction. In this case, the algorithm 
freezes the direction of the resolutions. 



• Use future resolutions. In this case, the 
algorithm computes a resolution in the future and 
holds it as long as it is still valid. 

We have currently settled on a variation of the 
second option, and are using a hysteresis filter that 
dampens the fluctuation between directions. Rapid 
changes over a short time period are ignored, 
preserving earlier calculated direction and 
coordination parameters. In the event an actual 
change of direction is needed once the critical point 
has been left, this registers after a few seconds. 

Revisiting Earlier Examples Using the 
New Algorithms 

The maneuvers of Figure 2 were excessive due 
to the divergence criteria. The new criteria produce 
the results shown in Figure 13. The gold vectors 
represent divergent vectors. 



Figure 14. No Horizontal Solution Problem Solved 

In Figure 6, we saw an example where original 
criteria solutions brought the aircraft within .01 nm of 
each other. The repulsive criteria algorithms 
produced the results shown in Figure 15. 



Figure 13. Extreme Maneuvers Problem Solved 

In Figure 4, we saw a situation where no 
horizontal maneuvers were obtained. The new criteria 
produce the results shown in Figure 14. 



Figure 15. Close Encounter Problem Solved 

The distance at closest approach is 0.84 nm. The 
gold dot on the future trajectories shows the point of 
closest approach. 

In Figure 10a, we saw a situation where the 
original criteria resulted in a fairly dramatic vertical 
maneuver. In Figure 16, we see the repulsive criteria 
in action. Here the aircraft is allowed to continue its 
descent. 



Figure 16. Wing Anomaly problem Solved 

In Figure 11, we saw a case where track 
resolutions became more and more severe until the 
ownship entered LoS, and then immediately relaxed. 
In Figure 17, we see a possible result of detecting the 
infeasibility of conflict avoidance resolutions and 
adopting a LoS resolution before actually entering 
loss of separation. 



Figure 17. Resolution with Turn Model 

In Figure 18, we see that even with track 
fluctuations the resolutions remain constant. 





Figure 18. Resolutions Near a Critical Point 


Conclusion 

This paper revisits previous work [2,3,5] on the 
development of criteria for implicitly coordinated 
loss of separation recovery maneuvers. The criteria 
previously proposed are based on the concepts of 
divergence and timeliness of the recovery maneuvers. 
Extensive experimentation has shown that even 
though that approach was satisfactory in many cases, 
it relied on overly optimistic assumptions, and thus 
resulted in poor performance in other cases. 

In this paper, new horizontal and vertical loss of 
separation recovery criteria are proposed. The new 
criteria are based on the concept of repulsiveness. 
Experimentation has shown that the new criteria 
successfully solves most of the problems encountered 
with the original approach. 
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